CVE-2026-37009: A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL
Summary
A SQL injection vulnerability (a security flaw where attackers can insert malicious database commands into user inputs) exists in NL2SQLTool, a component of crewai-tools version 1.10.2rc1, because the sql_query argument is not properly filtered. This allows an attacker to run any SQL commands they want on the database without authorization.
Vulnerability Details
EPSS: 0.0%
August 27, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-37009
First tracked: August 27, 2026 at 08:10 PM
Classified by LLM (prompt v3) · confidence: 95%